xorg-x11-server: XTestSwapFakeInput stack overflow

A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32 bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege...

Exploit for Out-of-bounds Write in Squid-Cache Squid

🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid ≤ 6.3 🛑...

The vulnerability of the WeGIA web manager, related to the failure to protect the SQL query structure, allows attackers to execute arbitrary SQL code.

The vulnerability of the WeGIA web manager is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

CVE-2013-10049 Raidsonic NAS Devices Unauthenticated Remote Command Execution

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone paramet...

CVE-2013-10048

The CVE-2013-10048 entry describes an OS command injection in legacy D-Link routers (DIR-300 rev B and DIR-600) due to unauthenticated input handling in the command.php endpoint. A remote attacker can send specially crafted POST requests to execute arbitrary shell commands with root privileges, e...

Synactis PDF In-The-Box 安全漏洞

Synactis PDF In-The-Box is a PDF generation and manipulation component from the French company Synactis. A security vulnerability exists in Synactis PDF In-The-Box that stems from a buffer overflow in the ConnectToSynactis method, which could lead to remote code execution...

The vulnerability of the SUSE Manager, a tool for centralized management of IT infrastructure, relates to the lack of authentication for critical functions. This allows attackers to execute arbitrary commands with root privileges.

The vulnerability of the SUSE Manager, a tool for centralized management of IT infrastructure, is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

HPESBNW04907 rev.1 - HPE Telco Service Orchestrator Software, Remote Command Execution Vulnerability

Potential Security Impact: Remote: Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.3.4 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-7783 |...

CVE-2014-125124 Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell...

CVE-2014-125124 Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell...

CVE-2014-125124

Summary: CVE-2014-125124 affects Pandora FMS

The vulnerability of D-Link DI-7300G+ microprogrammed software lies in the lack of measures taken to neutralize special elements during the processing of the ASP file httpd_debug.asp, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DI-7300G+ router microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the asp-file httpddebug.asp. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-45346

SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request...

gix-transport crate 操作系统命令注入漏洞

gix-transport crate is a Rust library open-sourced by GitoxideLabs. An operating system command injection vulnerability exists in gix-transport crate versions prior to 0.36.1, which stems from the fact that ssh command injection may lead to remote command execution...

Exploit for Path Traversal in Mikrotik Routeros

Ladon Scanner For Golang Wiki http://k8gege.org/Ladon/LadonGo.html Introduction LadonGo is an open source intranet penetration scanner framework, which can be used to easily detect segment C, B, A live hosts, fingerprint identification, port scanning, password explosion, remote execution, high-ri...

Exploit for CVE-2024-2961

sectoolset -- Github安全相关工具集合 主要内容： 0x00 漏洞利用实战练习&CTF安全竞赛 0x01 安全扫描器 0x02 安全防守 0x03 渗透测试 0x04 漏洞库及利用工具（POC，EXP 0x05 二进制及代码分析工具 0x06 威胁情报&蜜罐 0x07 安全文档资料 0x10 AI&大模型安全 0x11 所有内容 乌云镜像 乌云镜像，已挂 乌云镜像,已挂 近期安全热点 CVE-2025-48384: Git子模块回车符CR解析注入可致RCE GitHub MCP漏洞：劫持MCP服务访问私有仓库数据 glibc iconv中的缓冲区溢出导致PHP...

CVE-2025-54379 eKuiper API endpoints handling SQL queries with user-controlled table names.

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote...

CVE-2025-51472

Code Injection in AgentTemplate.evalagentconfig in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval without validati...

CVE-2025-51458

SQL Injection in editorsqlrun and queryex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with apieditorv1.editorsqlrun, editorchartrun, and...

CVE-2025-7286

IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the...